CVE-2026-115730 i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115730?
CVE-2026-115730 is a low-severity vulnerability in i18next-http-backend, published on 23 Oct 2026.
Official description
i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.
Weakness: CWE-74
Which versions are affected by CVE-2026-115730?
2 open source packages ship an affected version, including i18next-http-backend.
| Package | Affected | Fixed in |
|---|---|---|
i18next-http-backend npm | All versions | 4.0.3 |
i18next-http-backend npm | All versions | 4.0.3 |
How do I fix CVE-2026-115730?
Upgrade i18next-http-backend to 4.0.3 or later.
Is CVE-2026-115730 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-115730 exists.
Sources
Also known as GHSA-9jhj-wvmw-cfx5, UBUNTU-CVE-2026-115730.